53e226763fbb8785c8d636fd249df32ead81de335031e003c57a9163e1e51d06

Analysis

max time kernel
146s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31-12-2023 02:09

Target

23fd3891f337b30a0a7bcfb773981af1.dll
Size

144KB
MD5

23fd3891f337b30a0a7bcfb773981af1
SHA1

8070f5c5bae854a1e9a5d95539e5b072e5dcae25
SHA256

53e226763fbb8785c8d636fd249df32ead81de335031e003c57a9163e1e51d06
SHA512

920bdac4a8c6183bb6b70289627695852ae3e4a87cc64bd4898be02d012f159c59a35ad381d364784f8028f0a3df29f54e10a135f40ecb9bcf1ab438b351478a
SSDEEP

3072:cZ0vt3ito4EvmPk0wlE7V/LSu2KtOcJPWcBJVGzs4yoO:93+xhcnW7V/LXLWchGzsZH

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 4652	2652	regsvr32.exe	89
PID 2652 wrote to memory of 4652	2652	regsvr32.exe	89
PID 2652 wrote to memory of 4652	2652	regsvr32.exe	89

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\23fd3891f337b30a0a7bcfb773981af1.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\23fd3891f337b30a0a7bcfb773981af1.dll
  2⤵
  PID:4652